Question 320
After a prior facilities finding, a global logistics firm reports that the approved safeguard is implemented: “Assign physical access rights by role, zone and approved time window.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Assign physical access rights by role, zone and approved time window
- Run this adjacent but different test as the sole proof: Test a noncompliant and compliant device using the same authorized user
- Use the completion of this alternative as proof: Assume one entrance badge authorizes all interior zones
- Attempt restricted-area access using a general employee badge
Explanation
Correct Answer
D:Negative entry tests verify zoning.
Incorrect Answers
A:Attempt restricted-area access using a general employee badge. Negative entry tests verify zoning.
B:Context testing isolates the device-control decision. It tests devices, while this case requires evidence about facilities.
C:Outer entry does not establish need-to-know. Attempt restricted-area access using a general employee badge.
Question 321
After a prior applications finding, a regional hospital network reports that the approved safeguard is implemented: “Enforce application roles and object-level authorization independent of UI visibility.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Invoke the admin API as a support role and verify a deny response
- Run this adjacent but different test as the sole proof: Attempt restricted-area access using a general employee badge
- Use the completion of this alternative as proof: Hide the admin button in the front end
- Accept a signed change ticket saying: Enforce application roles and object-level authorization independent of UI visibility
Explanation
Correct Answer
A:Direct API tests detect broken access control.
Incorrect Answers
B:Negative entry tests verify zoning. It tests facilities, while this case requires evidence about applications.
C:API calls can bypass UI controls. Invoke the admin API as a support role and verify a deny response.
D:Invoke the admin API as a support role and verify a deny response. Direct API tests detect broken access control.
Question 322
A batch job uses the same identity as the lead administrator and remains active after that administrator leaves. Which response best addresses the central security requirement with a defensible, risk-based design?
- Provide a dedicated managed workload identity with scoped access and its own revocation lifecycle
- Give the workload the entire directory admin group
- Keep the administrator account because the batch succeeds
- Enforce device identity and posture before permitting sensitive application access
Explanation
Correct Answer
A:Machine authentication should not depend on a person's long-lived credentials.
Incorrect Answers
B:Excess privileges create broad compromise impact.
C:Functional success does not address ownership or deprovisioning.
D:A valid user does not automatically imply a trustworthy device. Provide a dedicated managed workload identity with scoped access and its own revocation lifecycle.
Question 323
An incident review documented this systems exposure: An internal application uses one shared privileged account for all administrators. The response team proposed only “Keep the shared account but change its display name weekly” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Unmanaged endpoints increase exposure.
- Broad administration increases impact.
- Copied secrets propagate across workloads.
- Renaming does not provide user attribution.
Explanation
Correct Answer
D:Renaming does not provide user attribution. The relevant alternative is renaming does not provide user attribution.
Incorrect Answers
A:This describes the unrelated devices decision rather than the named faulty measure Keep the shared account but change its display name weekly.
B:This describes the limitation of a different proposed action (Give every user local root rights); it does not identify the main defect in Keep the shared account but change its display name weekly.
C:Copied secrets propagate across workloads. The actual criticized measure is renaming does not provide user attribution.
Question 324
An incident review documented this devices exposure: An employee moves a managed laptop into an untrusted network and the device posture becomes noncompliant. The response team proposed only “Trust any device with the right hostname” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Unmanaged endpoints increase exposure.
- Overly broad machine privileges magnify compromise.
- Device names can be forged and do not establish trusted device identity.
- Renaming does not provide user attribution.
Explanation
Correct Answer
C:Device names can be forged and do not establish trusted device identity. The missing change involves device names can be forged and do not establish trusted device identity.
Incorrect Answers
A:This describes the limitation of a different proposed action (Allow all personal devices into regulated segments); it does not identify the main defect in Trust any device with the right hostname.
B:Overly broad machine privileges magnify compromise. The actual criticized measure is device names can be forged and do not establish trusted device identity.
D:Changing a shared account display name does not establish user attribution. Trusting a hostname likewise cannot prove a managed device’s identity or posture.
Question 325
A customer-facing bank issues high-risk accounts after validating only an unverified email address. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts
- Require extra passwords without proving initial identity
- Apply identity proofing proportional to transaction risk before binding strong authenticators
- Use a self-entered full name as proof
Explanation
Correct Answer
C:Proofing establishes the person's identity, while login authentication proves continuity.
Incorrect Answers
A:Authentication ends only when active session authority is revoked. Apply identity proofing proportional to transaction risk before binding strong authenticators.
B:Strong login to an unverified identity does not prove the customer.
D:An asserted name lacks independent verification.
Question 326
Administrators use SMS one-time codes and are being phished through relay attacks. Which response best addresses the central security requirement with a defensible, risk-based design?
- Lengthen SMS codes without changing their phishable nature
- Apply identity proofing proportional to transaction risk before binding strong authenticators
- Prioritize phishing-resistant FIDO2/WebAuthn authentication for privileged access
- Treat a password plus PIN as independent factors
Explanation
Correct Answer
C:Origin-bound authenticators are more resistant to relay than reusable one-time codes.
Incorrect Answers
A:Longer codes can still be relayed.
B:Proofing establishes the person's identity, while login authentication proves continuity. Prioritize phishing-resistant FIDO2/WebAuthn authentication for privileged access.
D:Two knowledge secrets are not necessarily distinct factor categories.
Question 327
A workforce wants passwordless authentication that resists shared secrets being harvested on fake websites. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use a long URL secret as the only authentication factor
- Use an AAA architecture with separate authentication, authorization and accounting for privileged actions
- Store one company-wide password in the browser
- Deploy public-key passkeys with device/user verification and trusted origin binding
Explanation
Correct Answer
D:Passkeys avoid transmitting reusable passwords to the relying party.
Incorrect Answers
A:A URL token may be copied.
B:AAA records who logged in, what was permitted and what occurred. Deploy public-key passkeys with device/user verification and trusted origin binding.
C:Shared credentials remain phishable.
Question 328
A user logs into several business applications with separate passwords and cannot be centrally revoked. Which response best addresses the central security requirement with a defensible, risk-based design?
- Disable application authorization because central login succeeded
- Federate applications with a central identity provider and controlled sessions and logout
- Grant just-in-time elevation with approvals, short expiry and monitored sessions
- Give every application an identical local password
Explanation
Correct Answer
B:Single sign-on centralizes authentication lifecycle and policy enforcement.
Incorrect Answers
A:SSO does not grant unlimited app privileges.
C:Time-limited rights reduce privilege exposure while preserving urgent access. Federate applications with a central identity provider and controlled sessions and logout.
D:Shared secrets do not create centralized revocation.
Question 329
Network administrators authenticate correctly but their configuration changes cannot be attributed to commands. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use an AAA architecture with separate authentication, authorization and accounting for privileged actions
- Log network throughput without user commands
- Enable only a shared password for all network devices
- Apply identity proofing proportional to transaction risk before binding strong authenticators
Explanation
Correct Answer
A:AAA records who logged in, what was permitted and what occurred.
Incorrect Answers
B:Traffic metrics do not attribute configuration actions.
C:Shared identity undermines accounting.
D:Proofing establishes the person's identity, while login authentication proves continuity. Use an AAA architecture with separate authentication, authorization and accounting for privileged actions.
Question 330
A banking web app keeps sessions valid after user logout and password reset. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts
- Set a longer session TTL after compromise
- Grant just-in-time elevation with approvals, short expiry and monitored sessions
- Hide the logout button but keep cookies active
Explanation
Correct Answer
A:Authentication ends only when active session authority is revoked.
Incorrect Answers
B:Longer validity increases exposure.
C:Time-limited rights reduce privilege exposure while preserving urgent access. Rotate and invalidate session identifiers at critical changes and enforce idle/absolute timeouts.
D:UI changes cannot revoke server sessions.
Certified Information Systems Security Professional (CISSP) Practice Tests